1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 16:22:37 +01:00
Files
archived-php-src/ext/session/tests/003.phpt
Máté Kocsis adb45a63c0 Fix GH-9186 @strict-properties can be bypassed using unserialization (#9354)
* Emit deprecation warnings when adding dynamic properties to classes during unserialization - this will become an Error in php 9.0.
  (Adding dynamic properties in other contexts was already a deprecation warning - the use case of unserialization was overlooked)
* Throw an error when attempting to add a dynamic property to a `readonly` class when unserializing
* Add new serialization methods `__serialize`/`__unserialize` for SplFixedArray to avoid creating deprecated dynamic
  properties that would then be added to the backing fixed-size array
* Don't add named dynamic/declared properties (e.g. $obj->foo) of SplFixedArray to the backing array when unserializing
* Update tests to declare properties or to expect the deprecation warning
* Add news entry

Co-authored-by: Tyson Andre <tysonandre775@hotmail.com>
2022-08-30 07:46:32 -04:00

50 lines
877 B
PHP

--TEST--
session object deserialization
--EXTENSIONS--
session
--SKIPIF--
<?php include('skipif.inc'); ?>
--INI--
session.use_cookies=0
session.use_strict_mode=0
session.cache_limiter=
session.serialize_handler=php
session.save_handler=files
--FILE--
<?php
error_reporting(E_ALL);
class foo {
public $bar = "ok";
public $yes;
function method() { $this->yes++; }
}
session_id("test003");
session_start();
session_decode('baz|O:3:"foo":2:{s:3:"bar";s:2:"ok";s:3:"yes";i:1;}arr|a:1:{i:3;O:3:"foo":2:{s:3:"bar";s:2:"ok";s:3:"yes";i:1;}}');
$_SESSION["baz"]->method();
$_SESSION["arr"][3]->method();
var_dump($_SESSION["baz"]);
var_dump($_SESSION["arr"]);
session_destroy();
?>
--EXPECT--
object(foo)#1 (2) {
["bar"]=>
string(2) "ok"
["yes"]=>
int(2)
}
array(1) {
[3]=>
object(foo)#2 (2) {
["bar"]=>
string(2) "ok"
["yes"]=>
int(2)
}
}